Mozilla Thunderbird vulnerabilities
2,511 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229
Vulnerabilities
Page 100 of 126
CVE-2026-12330P4MEDIUMCVSS 5.4≥ 140.0, < 140.12.02026-06-16
CVE-2026-12330 [MEDIUM] CWE-119 CVE-2026-12330: Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in
Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.
nvdmozilla
CVE-2026-74968P4MEDIUMCVSS 5.4fixed in 153.1.0fixed in 154.02026-08-18
CVE-2026-74968 [MEDIUM] CWE-346 CVE-2026-74968: Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74970P4MEDIUMCVSS 5.4fixed in 153.1.02026-08-18
CVE-2026-74970 [MEDIUM] CWE-346 CVE-2026-74970: Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-92068P4MEDIUMCVSS 5.4fixed in 153.3.0≥ 154.0, < 156.02026-09-15
CVE-2026-92068 [MEDIUM] CWE-346 CVE-2026-92068: Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Fire
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla
CVE-2026-6778P4MEDIUMCVSS 5.3fixed in 150.02026-04-21
CVE-2026-6778 [MEDIUM] CWE-476 CVE-2026-6778: Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150
Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
nvdmozilla
CVE-2026-12300P4MEDIUMCVSS 5.3fixed in 152.0.02026-06-16
CVE-2026-12300 [MEDIUM] CWE-119 CVE-2026-12300: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderb
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
nvdmozilla
CVE-2026-12301P4MEDIUMCVSS 5.3fixed in 152.0.02026-06-16
CVE-2026-12301 [MEDIUM] CWE-119 CVE-2026-12301: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderb
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
nvdmozilla
CVE-2026-6783P4MEDIUMCVSS 5.3fixed in 150.02026-04-21
CVE-2026-6783 [MEDIUM] CWE-190 CVE-2026-6783: Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnera
Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
nvdmozilla
CVE-2026-6775P4MEDIUMCVSS 5.3fixed in 150.02026-04-21
CVE-2026-6775 [MEDIUM] CWE-119 CVE-2026-6775: Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 a
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
nvdmozilla
CVE-2026-6779P4MEDIUMCVSS 5.3fixed in 150.02026-04-21
CVE-2026-6779 [MEDIUM] CWE-20 CVE-2026-6779: Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thun
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
nvdmozilla
CVE-2006-2781P4MEDIUMCVSS 6.4≤ 1.5.0.32006-06-02
CVE-2006-2781 [MEDIUM] CWE-119 CVE-2006-2781: Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before
Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.
nvdosv
CVE-2006-5748P4MEDIUMCVSS 5.0v1.0v1.0.1+10 more2006-11-08
CVE-2006-5748 [MEDIUM] CVE-2006-5748: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thu
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger memory corruption.
nvd
CVE-2026-113470P4UNKNOWNfixed in Thunderbird 158.0.1
CVE-2026-113470 Mozilla Foundation Security Advisory 2026-114: CVE-2026-113470
Mozilla Foundation Security Advisory 2026-114
CVE: CVE-2026-113470
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158.0.1
mozilla
CVE-2026-15719P4UNKNOWNfixed in Thunderbird 140.13
CVE-2026-15719 Mozilla Foundation Security Advisory 2026-72: CVE-2026-15719
Mozilla Foundation Security Advisory 2026-72
CVE: CVE-2026-15719
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140.13
mozilla
CVE-2012-1942P4HIGHCVSS 7.2v12.02012-06-05
CVE-2012-1942 [HIGH] CWE-264 CVE-2012-1942: The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMo
The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context.
nvd
CVE-2026-109764P4UNKNOWNfixed in Thunderbird 158
CVE-2026-109764 Mozilla Foundation Security Advisory 2026-109: CVE-2026-109764
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109764
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-117998P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117998 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117998
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117998
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117866P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117866 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117866
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117866
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117939P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117939 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117939
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117939
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117899P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117899 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117899
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117899
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla